@minimax-ai/code@0.5.3
Minimax Code — terminal coding agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a conditional credential-forwarding capability to an unrestricted operator-configured destination, not evidence of covert theft or malware. The lifecycle hook itself appears limited to a local native-module check.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The managed prompt feature is enabled and its service starts.
Impact
A caller able to set the environment variable could cause conditional exposure of the service token to another endpoint and influence managed prompts.
Mechanism
The refresh client selects the environment-provided base URL, attaches the captured access token, fetches a prompt bundle, and stores an accepted bundle.
AI rationale
This is a conditional credential-forwarding capability to an unrestricted operator-configured destination, not evidence of covert theft or malware. The lifecycle hook itself appears limited to a local native-module check.
Evidence
chunks/chunk-VORQSP3A.js
Network endpoints2
agent.minimax.ioagent.minimaxi.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The managed prompt client accepts a base URL from an environment variable without a destination allowlist.
- The client adds the captured access token as a Bearer authorization header and sends the request to that selected base URL.
- When enabled, the prompt service begins a scheduled refresh at startup and can persist a downloaded prompt bundle.
- The npm postinstall hook only runs a local native SQLite compatibility check.
Evidence against
- The default prompt endpoints are MiniMax domains.
- Downloaded prompt bundles are constrained by encryption and allowed-path validation.
- The prompt feature has an enabled gate.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetry
Source & flagged code
21 flaggedpackage.jsonView file
•scripts.postinstall = node ./verify-native-install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgchunks/chunk-YQCT64HF.jsView file
1import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-XJFOPESF.js";import{e as g,k as d,m as h}from"./chunk-JS2VCCBD.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
High
Child Process
Package source references child process execution.
chunks/chunk-YQCT64HF.jsView on unpkg · L11import { createRequire as __mavis_cR } from "module"; import { basename as __mavis_basename, dirname as __mavis_dirname, join as __mavis_join } from "path"; import { fileURLToPath ...
L2: import{a as p}from"./chunk-XJFOPESF.js";import{e as g,k as d,m as h}from"./chunk-JS2VCCBD.js";import{isAbsolute as f,resolve as A}from"node:path";import{spawn as E}from"node:child_...
Findings
3 Critical11 High9 Medium6 Low
CriticalEncoded Package Runner Executionchunks/chunk-FOYHC6FG.js
CriticalTrigger Reachable Dangerous Capabilitychunks/chunk-FOYHC6FG.js
CriticalPrevious Version Dangerous Deltachunks/chunk-7JIYXQBS.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processchunks/chunk-YQCT64HF.js
HighShellchunks/launcher-EJDM3IIM.js
HighSame File Env Network Executionchunks/chunk-TSW26OT4.js
HighCredential Redirect Persistencechunks/launcher-EJDM3IIM.js
HighCommand Output Exfiltrationchunks/chunk-TSW26OT4.js
HighSandbox Evasion Gated Capabilitychunks/chunk-YQCT64HF.js
HighCross File Remote Execution Context
Affected versions and remediation
This report applies to @minimax-ai/code@0.5.3.
See all versions of @minimax-ai/code for other recorded verdicts.
- Review the evidence and your use of @minimax-ai/code@0.5.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.